xtai[.]app

The domain xtai.app, which masquerades as a trading platform under the name XTradeAI, is part of a broader investment scam operation. Although the site is currently offline, it initially attracted attention by impersonating a legitimate investment service. This domain was flagged by 2 out of 95 vendors on VirusTotal, indicating some recognition of its malicious nature.

The domain was registered through NiceNIC International Group Co., Limited and hosted on an IP address managed by Cloudflare, Inc., located in the United States. Its SSL certificate was issued by Google Trust Services, which may lend an appearance of legitimacy to unsuspecting users. Despite being taken down, xtai.app was previously listed on a public blocklist managed by PhishDestroy, highlighting its involvement in fraudulent activities.

PhishDestroy's early detection of xtai.app, eight days before its official creation date, underscores the proactive measures taken to identify potential threats before they become widely recognized. This early detection is crucial in the fight against phishing, as it exploits the time gap between domain registration and the propagation of detection signatures across antivirus databases. The swift action to take down the domain reflects the ongoing efforts to protect users from investment scams that can lead to significant financial losses.